Weverse Data Breach Exposes Payment API and Transaction Data for 422,584 Accounts

Weverse Company president Yang Zooil announced a data breach affecting 422,584 user accounts on the HYBE-operated fan platform. A vulnerability in the payment information processing API exposed internal identification values and transaction-related data. The breach was not discovered by Weverse's internal security team, but was instead reported by an external party through Korea’s cybersecurity agency. This is the platform's second data security incident in 2026, following a January breach where impacted users were compensated with ₩100,000 (about $69 USD) in platform credits. In response, Weverse strengthened security for the payment information processing API by enhancing access controls and removing internal identifier information. "We deeply apologize to all the fans who trust and support Weverse for causing great concern and worry through this incident." — Yang Zooil